DEA-C01 Data Security and Governance Practice Test 21 — 15 Questions

Question 1

A company wants to grant read-only access to an S3 bucket for a data analyst. The analyst should be able to list objects and read object content. Which IAM policy effect and action combination is correct?

Accepted Answer

Effect: Allow, Actions: s3:ListBucket, s3:GetObject. Option A is correct because s3:ListBucket allows listing objects, and s3:GetObject allows reading objects. Option B is incorrect because s3:PutObject is write access. Option C is incorrect because s3:DeleteObject is not needed. Option D is incorrect because s3:ListAllMyBuckets is for listing all buckets, not bucket contents.

Answer

Effect: Allow, Actions: s3:GetObject, s3:DeleteObject

Answer

Effect: Allow, Actions: s3:ListAllMyBuckets, s3:GetObject

Answer

Effect: Allow, Actions: s3:PutObject, s3:GetObject

Question 2

A company is using Amazon EMR with Kerberos authentication. They want to ensure that data in transit between EMR cluster nodes is encrypted. Which configuration should be applied?

Accepted Answer

Configure the EMR cluster to use in-transit encryption.. Option D is correct because enabling in-transit encryption in Amazon EMR uses TLS to encrypt data between nodes. Option A is incorrect because S3 SSE encrypts data at rest. Option B is incorrect because EBS encryption encrypts data at rest. Option C is incorrect because VPC peering does not provide encryption; it is a network connectivity feature.

Answer

Use VPC peering to connect the cluster nodes.

Answer

Enable S3 server-side encryption for the cluster's output data.

Answer

Enable EBS encryption on the cluster instances.

Question 3

A data engineer needs to store sensitive data in Amazon S3 and automatically classify the data using a managed service. The data is uploaded via an S3 bucket. Which AWS service can automatically detect and classify sensitive data?

Accepted Answer

Amazon Macie. Option C is correct because Amazon Macie uses machine learning to discover and classify sensitive data in S3. Option A is incorrect because AWS Shield is for DDoS protection. Option B is incorrect because Amazon Inspector is for vulnerability assessment on EC2. Option D is incorrect because AWS WAF is a web application firewall.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 4

A company is using AWS Lake Formation to manage permissions on a data lake. They want to grant a data scientist the ability to query tables in the 'analytics' database using Amazon Athena, but prevent them from accessing the underlying S3 data directly. What is the best way to achieve this?

Accepted Answer

Grant SELECT permission on the 'analytics' database tables in Lake Formation.. Option A is correct because Lake Formation can grant SELECT permission on tables, and with Lake Formation metadata filtering, the user can query via Athena without direct S3 access. Option B is incorrect because granting s3:GetObject on the entire bucket would allow direct access. Option C is incorrect because they need access to the database objects, not just the database. Option D is incorrect because IAM policies for Athena do not restrict S3 access.

Answer

Grant the data scientist an IAM policy with s3:GetObject on the S3 bucket.

Answer

Create an IAM policy that allows Athena queries only.

Answer

Add the data scientist to a Lake Formation data lake location with read access.

Question 5

A company is designing a data pipeline using Amazon Kinesis Data Streams. The data includes personally identifiable information (PII). The security team requires that data be encrypted at rest using a customer-managed KMS key. How should the data engineer configure the Kinesis stream?

Accepted Answer

Enable server-side encryption on the Kinesis stream and specify the customer-managed KMS key.. Option A is correct because Kinesis Data Streams supports server-side encryption using a KMS key. Option B is incorrect because client-side encryption must be implemented by the producer, not the stream. Option C is incorrect because CloudHSM is not directly supported for Kinesis encryption. Option D is incorrect because Kinesis does not use S3 for storage.

Answer

Configure the Kinesis stream to use AWS CloudHSM for encryption.

Answer

Store the encrypted data in S3 and use Kinesis to stream the S3 object keys.

Answer

Use client-side encryption in the producer application to encrypt data before sending to Kinesis.

Question 6

A company wants to use AWS CloudTrail to monitor data events for an S3 bucket. Which TWO configurations are required to capture object-level API operations?

Accepted Answer

Configure the CloudTrail trail to log data events for the S3 bucket.. Option B and Option D are correct. CloudTrail must be enabled in the S3 bucket's Region, and data events for S3 must be specified to capture object-level operations. Option A is incorrect because S3 server access logs are separate. Option C is incorrect because management events capture bucket-level operations, not object-level. Option E is incorrect because CloudWatch Events is not required for CloudTrail to capture events.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 server access logs on the bucket.

Answer

Set up an Amazon CloudWatch Events rule to capture S3 events.

Question 7

A company is using AWS KMS with customer-managed keys to encrypt data in Amazon RDS. The security team wants to ensure that the key can be rotated automatically every year. Which THREE steps are required to achieve automatic key rotation?

Accepted Answer

Enable automatic key rotation in the KMS key configuration.. Options B, C, and D are correct. To enable automatic rotation for a customer-managed KMS key, you must enable rotation via the KMS console or API (B), ensure the key is a symmetric key (C) as asymmetric keys do not support automatic rotation, and configure the RDS instance to use the key (D) for encryption. Option A is incorrect because rotation can be enabled for existing keys. Option E is incorrect because CloudHSM is not involved.

Answer

Migrate the key to AWS CloudHSM.

Answer

Create a new KMS key and configure RDS to use it.

Question 8

A data engineer needs to monitor and log changes to IAM policies in an AWS account. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. Options A and B are correct. AWS CloudTrail logs IAM API calls, and Amazon CloudWatch Logs can store and monitor those logs. Option C is incorrect because AWS Config tracks resource configuration but not API calls directly. Option D is incorrect because Amazon GuardDuty is a threat detection service. Option E is incorrect because VPC Flow Logs capture network traffic.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 9

A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Additionally, they want to ensure that the encryption context is enforced for all PutObject requests. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS with the desired KMS key.. Options A, C, and E are correct. To enforce encryption context, you must use a bucket policy with a condition for kms:EncryptionContext (A). You must also set the default encryption on the bucket to SSE-KMS (C). The IAM role used by applications must have permission to use the KMS key (E). Option B is incorrect because the bucket policy can enforce encryption context without SSE-C. Option D is incorrect because SSE-S3 is not allowed.

Answer

Configure the bucket to use SSE-C and provide the encryption key.

Answer

Enable S3 Versioning on the bucket.

Question 10

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS.. Options A and D are correct. To encrypt data at rest, enable encryption on the Redshift cluster using KMS (A). To encrypt data in transit, configure the cluster to use SSL (D). Option B is incorrect because VPC Flow Logs do not encrypt. Option C is incorrect because EBS encryption is not directly applicable to Redshift cluster storage. Option E is incorrect because Redshift does not support CloudHSM natively for encryption; it uses KMS for at-rest encryption.

Answer

Use AWS CloudHSM to manage encryption keys for Redshift.

Answer

Enable VPC Flow Logs on the Redshift subnet.

Answer

Enable EBS encryption on the Redshift cluster nodes.

Question 11

A company runs a data lake on Amazon S3 with AWS Glue and Amazon Athena. The security team recently ran a report using Amazon Macie and found that multiple S3 objects containing PII are publicly accessible. The data engineer is tasked with remediating this issue immediately. The S3 bucket is configured with a bucket policy that grants public read access to all objects. The data engineer needs to ensure that no objects are publicly accessible while maintaining the ability for authorized IAM users and roles to access the data via Athena. The bucket must also remain accessible to the Glue crawler. What is the MOST effective course of action?

Accepted Answer

Remove the bucket policy granting public access and attach an IAM policy to the Glue and Athena roles to allow access to the bucket.. Option B is correct because removing the bucket policy that grants public access and using an S3 bucket policy or IAM policies to allow specific IAM principals (like Glue and Athena) resolves the public exposure while allowing authorized access. Option A is incorrect because Macie does not enforce access control. Option C is incorrect because enabling block public access is a good practice but does not grant access to authorized users; it may also block Glue if not configured correctly. Option D is incorrect because ACLs are legacy and less secure; also, public objects may have ACLs granting public access.

Answer

Use Amazon Macie to automatically remediate the public access by updating the object ACLs.

Answer

Set the bucket ACL to private and add a bucket policy that allows access to the Glue crawler and Athena.

Answer

Enable S3 Block Public Access on the bucket and use a bucket policy to allow access from the Glue and Athena service principals.

Question 12

A company uses Amazon RDS for MySQL to store application data. The security team requires that all database credentials be rotated automatically every 90 days. The data engineer needs to implement a solution that minimizes operational overhead. The database credentials are stored in AWS Secrets Manager. The application retrieves the credentials at startup and caches them for the duration of the session. The application is deployed on Amazon ECS with Fargate. Which solution should the data engineer implement to meet the rotation requirement with minimal overhead?

Accepted Answer

Use Secrets Manager's automatic rotation feature with a custom Lambda function that updates the RDS password.. Option C is correct because Secrets Manager can automatically rotate secrets using a Lambda function that updates the RDS password. This minimizes overhead compared to manual rotation or changing IAM policies. Option A is incorrect because IAM database authentication is a separate feature that does not rotate credentials automatically. Option B is incorrect because manual rotation is operationally heavy. Option D is incorrect because Parameter Store does not have built-in rotation; it would require additional automation.

Answer

Store the credentials in AWS Systems Manager Parameter Store and use a scheduled job to update the password.

Answer

Create a scheduled Lambda function that updates the password in Secrets Manager and manually updates the application configuration.

Answer

Configure IAM database authentication for the RDS instance and update the application to use IAM credentials.

Question 13

A company is using Amazon S3 to store log files. The security team wants to ensure that any object uploaded to the S3 bucket is automatically scanned for malware before being processed by downstream applications. The data engineer needs to implement a solution that integrates with AWS services and minimizes latency. The bucket receives thousands of objects per day. Which solution should the data engineer use?

Accepted Answer

Enable Amazon GuardDuty with malware protection for S3.. Option B is correct because Amazon GuardDuty has a malware protection feature that can scan S3 objects for malware upon upload. It integrates with S3 events and minimizes latency. Option A is incorrect because Amazon Macie is for sensitive data discovery, not malware. Option C is incorrect because AWS WAF is for web application firewall, not S3 scanning. Option D is incorrect because running a custom scanning solution on EC2 adds operational overhead and latency.

Answer

Deploy an EC2 instance with antivirus software that triggers on S3 events.

Answer

Use AWS WAF to inspect objects as they are uploaded.

Answer

Enable Amazon Macie on the S3 bucket to detect malware.

Question 14

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. However, when a data engineer attempts to upload an object using the AWS CLI, the upload fails with an access denied error. The engineer has s3:PutObject permission on the bucket. Which additional permission is most likely missing?

Accepted Answer

kms:GenerateDataKey. To upload an object with SSE-KMS, the IAM user or role must have kms:GenerateDataKey permission to generate a data key for encryption. Option A is correct because without it, the upload fails. Option B is wrong because kms:Decrypt is for decryption, not upload. Option C is wrong because kms:CreateKey is for creating keys, not using them. Option D is wrong because s3:PutObjectAcl is for ACLs, not encryption.

Answer

kms:CreateKey

Answer

kms:Decrypt

Answer

s3:PutObjectAcl

Question 15

A data engineering team uses AWS Glue ETL jobs to process data from an S3 data lake and load it into an Amazon Redshift cluster. The security policy mandates that all data in transit between AWS Glue and Redshift must be encrypted using TLS. The team uses a JDBC connection. Currently, the connection is failing with an SSL-related error. Which configuration change should the team make to ensure encrypted connectivity?

Accepted Answer

Update the JDBC connection string to include ssl=true and sslmode=require.. To enforce SSL for JDBC connections to Redshift, you must add the ssl=true parameter in the connection URL. Option D is correct. Option A is wrong because the security group controls network access, not encryption. Option B is wrong because enabling encryption on the S3 bucket does not affect the Glue-to-Redshift connection. Option C is wrong because Redshift uses SSL by default, but the JDBC driver requires explicit ssl=true in the URL to enable it.

Answer

Modify the Redshift security group to allow inbound traffic on port 5439 from the Glue subnet.

Answer

Enable server-side encryption on the S3 bucket using AWS KMS.

Answer

Set the Redshift cluster parameter group to require_ssl=ON.